diff options
| author | Werner Koch <[email protected]> | 2014-12-22 11:16:46 +0000 |
|---|---|---|
| committer | NIIBE Yutaka <[email protected]> | 2015-01-13 01:49:57 +0000 |
| commit | 907a9a1e986b8c8266f4f01e8ed82acfc636a519 (patch) | |
| tree | 75edc458234ede0879120373611234cad5a959c6 | |
| parent | gpg: Fix possible read of unallocated memory (diff) | |
| download | gnupg-907a9a1e986b8c8266f4f01e8ed82acfc636a519.tar.gz gnupg-907a9a1e986b8c8266f4f01e8ed82acfc636a519.zip | |
gpgsm: Return NULL on fail
* sm/gpgsm.c (parse_keyserver_line): Set SERVER to NULL.
--
Cherry-pick of abd5f6752d693b7f313c19604f0723ecec4d39a6.
Reported-by: Joshua Rogers <[email protected]>
"If something inside the ldapserver_parse_one function failed,
'server' would be freed, then returned, leading to a
use-after-free. This code is likely copied from sm/gpgsm.c, which
was also susceptible to this bug."
Signed-off-by: Werner Koch <[email protected]>
| -rw-r--r-- | sm/gpgsm.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/sm/gpgsm.c b/sm/gpgsm.c index 97ec4bbf6..855de83d6 100644 --- a/sm/gpgsm.c +++ b/sm/gpgsm.c @@ -840,6 +840,7 @@ parse_keyserver_line (char *line, { log_info (_("%s:%u: skipping this line\n"), filename, lineno); keyserver_list_free (server); + server = NULL; } return server; |